amazon-fsx

How to limit the FSxN file systems that a process can see?

I am trying to limit a process to be able to list only certain FSx systems. I have a role attached to my EC2 instance that includes a statement as follows.

"Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "fsx:Describe*",
                "fsx:List*",
                "fsx:UpdateFileSystem"
            ],
            "Resource": [
                "arn:aws:fsx:us-west-2:75xxxxxxx648:file-system/fs-0e8d9xxxxxxxef3b",
                "arn:aws:fsx:us-west-2:75xxxxxxx648:file-system/fs-07bcxxxxxxxx5e43"
            ]
        }

But when I try to list the filesystems I get errors when using the describe action.

ubuntu@ip-10-129-10-194:~$ aws fsx describe-file-systems --region=us-west-2
 
An error occurred (AccessDeniedException) when calling the DescribeFileSystems operation: User: arn:aws:sts::75xxxxxxx648:assumed-role/Cloud-Manager-Operator-399y9hM/i-00d9xxxxxxf16 is not authorized to perform: fsx:DescribeFileSystems on resource: arn:aws:fsx:us-west-2:75xxxxxxx648:file-system/* because no identity-based policy allows the fsx:DescribeFileSystems action

Even if specify one of the FSxN file systems I have listed in the role I get an error:

ubuntu@ip-10-129-10-194:~$ aws fsx describe-file-systems --region=us-west-2 --file-system-ids fs-07bxxxxxx5e43
 
An error occurred (AccessDeniedException) when calling the DescribeFileSystems operation: User: arn:aws:sts::75xxxxxxx648:assumed-role/Cloud-Manager-Operator-399y9hM/i-00d9bxxxxxff16 is not authorized to perform: fsx:DescribeFileSystems on resource: arn:aws:fsx:us-west-2:75xxxxxxx648:file-system/* because no identity-based policy allows the fsx:DescribeFileSystems action

Does anyone know of a way I can get AWS to silently ignore the filesystems I don't have access to?

Solution

  • Limiting describe functions to particular FSx systems is not supported. Note on the following page: https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonfsx.html

    resourcetype

    And if you look at the DescribeFileSystems column there is no value in the Resource types column.

    DescribeFileSystem

    Note, it is supported to limit Updates/Deletes for a particular FSx system.